Security Checklist

Web has configured accurate source whitelisting.
iOS, Android have configured correct package identification and signature verification.
Reasonable rate limits has been set for each integration.
Server keys are only saved in a secure location on the server.
Webhook uses HTTPS, Token verification and idempotent processing.
Monitor organization usage, integration usage and abnormal errors.